CSRF ومتى ينطبق

في هذا الدرس

know when cross-site request forgery matters.

الموضوعات المخطط لها

• CSRF: a malicious site makes the user's browser send a request to your site, and the browser attaches the user's cookies automatically.
• It matters when authentication is carried by cookies that the browser sends by itself.
• Defenses: CSRF tokens, SameSite cookies, and checking the request origin.
• If your API uses an Authorization header token that scripts add explicitly, the browser does not add it on its own, so CSRF is not the same risk.
• CORS and CSRF are different: CORS controls which pages may read responses; CSRF defends state-changing requests that use cookies.